CVE-2026-5330: Courier Management System Auth Bypass Flaw

CVE-2026-5330 Overview

A vulnerability was found in SourceCodester/mayuri_k Best Courier Management System 1.0. Affected by this issue is the User Delete Handler functionality in the file /ajax.php?action=delete_user. This vulnerability involves improper access controls (CWE-266: Incorrect Privilege Assignment) that can be exploited by manipulating the ID argument. The attack can be initiated remotely without authentication, allowing unauthorized users to delete user accounts from the system.

Critical Impact

Unauthenticated attackers can remotely delete user accounts from the Best Courier Management System by manipulating the ID parameter, potentially causing service disruption and data loss.

Affected Products

• SourceCodester Best Courier Management System 1.0
• mayuri_k Best Courier Management System 1.0

Discovery Timeline

• April 2, 2026 - CVE-2026-5330 published to NVD
• April 2, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5330

Vulnerability Analysis

This vulnerability stems from a Broken Access Control flaw in the Best Courier Management System's user deletion functionality. The affected endpoint /ajax.php?action=delete_user fails to properly validate whether the requesting user has authorization to perform user deletion operations. This allows any remote attacker to delete arbitrary user accounts by directly accessing the vulnerable endpoint and manipulating the ID parameter.

The lack of authentication and authorization checks on this administrative function represents a significant security oversight. An attacker can enumerate valid user IDs and systematically remove users from the system, potentially locking out legitimate administrators and users.

Root Cause

The root cause of this vulnerability is improper access control implementation (CWE-266: Incorrect Privilege Assignment). The delete_user action handler in ajax.php does not verify:

1. Whether the current session belongs to an authenticated user
2. Whether the authenticated user has administrative privileges to delete other users
3. Whether the user has authorization to delete the specific user account identified by the ID parameter

This allows the endpoint to be accessed without any credentials, enabling unauthenticated remote exploitation.

Attack Vector

The vulnerability can be exploited remotely over the network. An attacker can craft HTTP requests to the vulnerable endpoint with arbitrary user IDs to delete user accounts. The attack requires no authentication or user interaction.

The exploitation flow involves sending a direct request to the /ajax.php?action=delete_user endpoint with a target user's ID parameter. Since no authentication or authorization checks are performed, the system processes the deletion request regardless of who initiated it. Technical details and proof-of-concept information can be found in the GitHub Vulnerability Report.

Detection Methods for CVE-2026-5330

Indicators of Compromise

• Unusual volume of HTTP requests to /ajax.php?action=delete_user endpoint
• User deletion events without corresponding administrator login sessions
• Rapid sequential deletion of multiple user accounts
• Access logs showing unauthenticated requests to the delete_user endpoint with varying ID parameters

Detection Strategies

• Monitor web server access logs for requests to /ajax.php containing action=delete_user without valid session authentication
• Implement alerting for user deletion operations that occur outside normal administrative workflows
• Deploy web application firewall (WAF) rules to detect and block suspicious parameter manipulation attempts
• Audit user account changes and correlate with authenticated administrative sessions

Monitoring Recommendations

• Enable verbose logging for all user management operations in the application
• Configure SIEM rules to alert on unauthenticated access attempts to administrative endpoints
• Implement database-level auditing for DELETE operations on user tables
• Monitor for enumeration patterns in ID parameter values across multiple requests

How to Mitigate CVE-2026-5330

Immediate Actions Required

• Restrict access to the /ajax.php?action=delete_user endpoint at the web server or network level
• Implement authentication requirements for all user management endpoints
• Add authorization checks to verify the requesting user has administrative privileges before processing deletion requests
• Consider temporarily disabling the delete_user functionality until a proper fix is implemented

Patch Information

No official vendor patch has been released at the time of this advisory. Users should monitor the VulDB entry and vendor resources for updates. Given that this is an open-source project, users may need to implement their own fixes or consider alternative solutions.

Workarounds

• Apply web server configuration rules (Apache .htaccess or Nginx location blocks) to restrict access to the vulnerable endpoint to trusted IP addresses only
• Implement a reverse proxy with authentication requirements in front of the application
• Add server-side session validation and role-based access control checks before the delete operation
• Consider using a Web Application Firewall (WAF) to block unauthorized requests to the affected endpoint

# Apache .htaccess configuration to restrict access
<Files "ajax.php">
    <If "%{QUERY_STRING} =~ /action=delete_user/">
        Require ip 192.168.1.0/24
        Require ip 10.0.0.0/8
    </If>
</Files>